Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6e3cfa58 by Salvatore Bonaccorso at 2026-09-30T10:23:55+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -7,9 +7,9 @@ CVE-2026-96886 (The Course Booking System WordPress plugin
before 7.0.9 does not
CVE-2026-96649 (The Frontend Post Submission Manager Lite \u2013 Frontend
Posting Word ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96587 (The Viidure Android application embeds permanent, plaintext
cloud stor ...)
- TODO: check
+ NOT-FOR-US: Viidure
CVE-2026-96274 (In Baicells Nova 430H, an unauthenticated device within radio
range ca ...)
- TODO: check
+ NOT-FOR-US: Baicells Nova 430H
CVE-2026-94953 (A stack-based buffer overflow vulnerability exists in the web
manageme ...)
NOT-FOR-US: TOTOLINK
CVE-2026-94952 (A stack-based buffer overflow vulnerability exists in the web
manageme ...)
@@ -19,7 +19,7 @@ CVE-2026-94297 (The Media Library Organizer WordPress plugin
before 2.1.4 does
CVE-2026-94274 (The YayReviews WordPress plugin before 1.4.1 does not
restrict access ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94204 (The central cloud storage backend for the entire dashcam
platform is m ...)
- TODO: check
+ NOT-FOR-US: Viidure
CVE-2026-93853 (Unverified ownership in Barman snapshot backup deletion allows
a princ ...)
TODO: check
CVE-2026-93580 (The InPost PL WordPress plugin before 1.9.8 does not verify
the authen ...)
@@ -31,7 +31,7 @@ CVE-2026-92424 (The Content Egg WordPress plugin before
11.9.0 does not verify
CVE-2026-91832 (The WP Mobile Menu WordPress plugin before 2.9 does not
correctly ver ...)
NOT-FOR-US: WordPress plugin
CVE-2026-91191 (The device's update mechanism includes conditions that allow
unauthori ...)
- TODO: check
+ NOT-FOR-US: Lantronix
CVE-2026-91072 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does
not confin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-91051 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does
not preven ...)
@@ -83,7 +83,7 @@ CVE-2026-85415 (The Audio Player Block WordPress plugin
before 1.6.3 does not v
CVE-2026-85001 (The EmbedPress WordPress plugin before 4.6.7 does not
sanitise and es ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84409 (The device's update mechanism retrieves metadata for software
updates ...)
- TODO: check
+ NOT-FOR-US: Lantronix
CVE-2026-83560 (The New User Approve WordPress plugin before 3.2.10 does not
properly ...)
NOT-FOR-US: WordPress plugin
CVE-2026-82127 (The Schema & Structured Data for WP & AMP WordPress plugin
before 1.67 ...)
@@ -95,21 +95,21 @@ CVE-2026-81841 (Pausing a shared (public) dashboard did not
revoke its access to
CVE-2026-81433 (A stack-based buffer overflow vulnerability in WatchGuard
Fireware OS' ...)
NOT-FOR-US: WatchGuard
CVE-2026-81310 (Image Scanner Driver for Linux contains a link following
vulnerability ...)
- TODO: check
+ NOT-FOR-US: Ricoh
CVE-2026-80333 (The Solace Extra WordPress plugin before 1.7.2 does not
perform any au ...)
NOT-FOR-US: WordPress plugin
CVE-2026-79538 (metatool-ai MetaMCP up to and including 2.4.22 is vulnerable
to Code E ...)
- TODO: check
+ NOT-FOR-US: metatool-ai MetaMCP
CVE-2026-79537 (metatool-ai MetaMCP through 2.4.22 contains an insecure direct
object ...)
- TODO: check
+ NOT-FOR-US: metatool-ai MetaMCP
CVE-2026-79536 (bytebase dbhub v1.2.0 was discovered to contain a SQL
injection vulner ...)
- TODO: check
+ NOT-FOR-US: bytebase dbhub
CVE-2026-79535 (mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command
Injection. The ...)
- TODO: check
+ NOT-FOR-US: mbailey VoiceMode
CVE-2026-79534 (mark3labs mcp-filesystem-server v0.11.1 is vulnerable to
Directory Tra ...)
- TODO: check
+ NOT-FOR-US: mark3labs mcp-filesystem-server
CVE-2026-79417 (Improper Access Control in ArgusMonitor.sys in Argotronic eGbR
ArgusMo ...)
- TODO: check
+ NOT-FOR-US: Argotronic eGbR ArgusMonitor
CVE-2026-79403 (An issue in Kilo Code before v7.4.1 allows a local attacker to
execute ...)
TODO: check
CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level
authorization ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e3cfa58dc9c9e1a9b4864bbd21d761ff26338d1
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e3cfa58dc9c9e1a9b4864bbd21d761ff26338d1
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
